# CVE-2026-59765: Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata

Source: https://junglewise.ai/threats/cve-2026-34966-gitea-ssrf-via-migration-asset-downloads-bypasses-hostmatcher  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05  
License: CC BY 4.0 with a link back

CVE-2026-59765 · Severity: high · CVSS 7.6 · Published 2026-08-05

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.

Technologies: [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea), [gitea.dev (Go)](https://junglewise.ai/threats/technologies/gitea-dev). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-59765 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59765 being exploited in the wild.

**How severe is CVE-2026-59765?** High severity, with a CVSS score of 7.6, published 5 August 2026.

**Which products and versions are affected?** code.gitea.io/gitea (Go) SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

**Is there a fix for CVE-2026-59765?** Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-59765?** Check whether you run code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- code.gitea.io/gitea (Go): upgrade to 1.27.0 or later

  ```sh
  go get code.gitea.io/gitea@v1.27.0
  ```

- gitea.dev (Go): upgrade to 1.27.0 or later

  ```sh
  go get gitea.dev@v1.27.0
  ```


## Affected products

- code.gitea.io/gitea (Go) SEMVER:introduced=0,fixed=1.27.0
- gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0

## Identifiers

- CVE-2026-59765
- CVE-2026-34966
- GHSA-2wm4-vwp6-v7xc
- GO-2026-6039

## Related threats

- [Gitea incorrect authorization in starred repos and tracked times API](https://junglewise.ai/threats/cve-2026-59766-gitea-incorrect-authorization-in-starred-repos-and-tracked-times)
- [Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.](https://junglewise.ai/threats/cve-2026-60004-gitea-code-injection-in-diffpatch-api)
- [SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata](https://junglewise.ai/threats/cve-2026-59765-gitea-ssrf-and-local-file-read-via-migration-asset-bypass)
- [Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads](https://junglewise.ai/threats/cve-2026-59763-gitea-resource-amplification-in-arch-package-metadata-parsing)
- [GO-2026-6074 - Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation…](https://junglewise.ai/threats/go-2026-6074-gitea-api-fork-endpoint-authorization-bypass-allows-a93de534)